Business goals, IT priorities

The approach below is my synthesis, not a requirement of any individual standard. I explain their role after the practical steps. In a small company it works on a single sheet of paper, and in a large one it needs to be extended with tools.

1. State the goal as an outcome, not as a task. Instead of "implement a CRM", write "raise the share of repeat customers from 30% to 40% within 18 months". The figures in this sentence are an example.
2. Identify what in the organisation limits achieving the outcome. A process, data, skills, a system. The business is responsible for this together with IT, not the IT department alone.
3. Collect candidate initiatives. For each, record the business goal, operational need or legal obligation. Include legal requirements in the shared resource plan, treating their deadlines and scope as constraints. Return requests without a rationale for clarification; minor maintenance work may have a separate queue, but its demand on capacity must remain visible in the plan.
4. Assess them against the same criteria. Four are enough: contribution to the goal, risk (including the risk of not doing it), total cost, and the organisation's ability to carry out the change. This is my simplified set of criteria for assessing initiatives. For legal obligations, assess how to meet the requirement on time and at what cost, rather than whether to comply.
5. Set limits. A team's capacity is finite. A list of ten "priorities" often means in practice no priority. Agree in advance that once capacity is exceeded, a new item can enter only if another leaves.
6. Appoint an owner on the business side and hold a review every quarter. Gartner describes precisely this shared responsibility of business and IT as a feature of the best-performing companies (see “The scale of the problem”)[1].

A business goal and an IT task are expressed in different languages. The board says: "shorten order fulfilment time from five days to three". IT hears: "do something about the warehouse system". Only someone who understands both worlds can say that the bottleneck is the manual entry of orders from three sales channels, and that this is what goes to the top of the list.

• Which three business goals matter most this year, and how will we measure whether they have been achieved?
• Which IT initiative supports which goal? Can we say so for every item on the list?
• Who on the business side is accountable for the outcome of each initiative, and not only for its delivery?
• What share of the IT team's work goes on maintenance and what share on change? Did we choose this split deliberately?
• What will we remove from the plan if a new priority arrives?

Evidence on the success of digital initiatives comes from the 2025 Gartner CIO and Technology Executive Survey, whose findings were published in October 2024. It covered 3,186 IT executives from 88 countries and 1,126 business leaders outside IT. The result: on average, 48% of digital initiatives meet or exceed their business targets. In a separate group of companies that Gartner called "Digital Vanguard", the figure is 71%[1].

What sets these companies apart? According to Gartner, above all that they share responsibility for digital delivery between the CIO and the other board members. Their business executives also dedicate 35% of their business-area staff to working on technology (21% for the others) and meet with the CIO four times more often than other executives outside IT do[1]. This describes features that occur together with better results, not proof that they cause them. Gartner's release also does not give the size of this group.

Older studies show that the problem is not new. McKinsey, together with the University of Oxford, analysed more than 5,400 IT projects. Large projects (budget above USD 15 million) exceeded their budgets by 45% on average and their schedules by 7%, and delivered 56% less value than predicted. According to the authors, 17% of projects went so badly that they threatened the existence of the company[2]. The analysis dates from 2012 and concerns large programmes, so it should not be applied directly to a system implementation in a company of 80 people. It does, however, show the scale of the risk in large IT projects. My own conclusion is that the risk grows when a project's value is assumed at the start and nobody checks it afterwards.

In its 2016 "Pulse of the Profession" report, PMI estimated that organisations waste an average of USD 122 million for every billion spent on projects. In organisations with high maturity in benefits management the loss was 5.4%, in organisations with low maturity 16.6%[3]. These data are from 2016, and I cite them from a secondary source.

COBIT 2019 (ISACA) is built on a goals cascade that links stakeholder needs to enterprise goals, IT alignment goals, and governance and management objectives[4][5]. The author of the study I draw on stresses that the cascade is not a conversion table. The mapping shows what matters, and it becomes a commitment only after a decision by the leadership. What should be left at the end is a small set of priorities, not a full matrix of links[5].

ISO/IEC 38500:2024 addresses the governance of IT within an organisation[6][7].

ITIL 4 starts from the principle "focus on value": first establish who the stakeholders are and what outcomes they expect. The remaining principles are just as practical: start where you are, work iteratively with feedback, keep it simple, and automate only what has first been optimised[8].

TOGAF (The Open Group) and ISO/IEC 27001 add two further points. In the TOGAF method (ADM, the Architecture Development Method), once the architecture vision has been defined, business architecture comes next, and only after it systems and technology[9]. ISO/IEC 27001 requires that an information security management system follow from the context of the organisation and a risk assessment[10]. I base both descriptions on the general characteristics of the standards.

One thing follows from these standards: an IT priority is good when it can be traced back to a goal approved by the board, and forward to a measurable result.

A note on the data: Eurostat surveys enterprises in the industries covered by the survey, with at least 10 employees and self-employed persons. In Poland, 97.2% of active companies are micro-enterprises, while small, medium and large ones account for 2.0%, 0.6% and 0.2% respectively (data from PARP, the Polish Agency for Enterprise Development, for 2024, 2.37 million companies in total)[11]. The figures below therefore describe the "upper part" of the market.

Source: Eurostat[12][13]; the data cover companies with 10 or more employees. For Poland, Eurostat reports AI use at 8.4% of companies, the second lowest in the EU (only Romania is lower)[13].

Among companies that had considered AI but had not adopted it, the most common barrier was a lack of knowledge (around 70%), while unclear legal consequences and data protection concerns were each cited by roughly half of them[13]. These are barriers of knowledge, law and risk, not of hardware. My interpretation: in some companies there may be no one to define what purpose the technology is meant to serve.

Small companies (up to 49 people). A full framework would be overkill here. COBIT does have a separate guide for SMEs (small and medium-sized enterprises)[4], but in practice a rhythm is enough: once a quarter, the owner or CEO and the person responsible for IT (often external) agree, over a single sheet of paper, three goals for the year and three to five initiatives under them. A good additional question is whether the implementation can be handled without new hires. Tidying up what is already there often brings more, in line with the principle "start where you are"[8].

Medium-sized companies (50–249 people). This is where the problem of competing requests from departments often begins. What is needed is a simple register of initiatives with one common set of criteria, and a regular steering committee meeting (the finance, operations, sales and IT directors). IT should present options and costs here, and not merely carry out orders.

Large organisations (250+ people). A portfolio of initiatives appears, along with a project or transformation management office and several layers of goals. This is where the COBIT goals cascade, governance according to ISO/IEC 38500 and enterprise architecture work best. The risk is bureaucracy without an owner. McKinsey points out that large projects need, among other things, strategy and stakeholder management, cohesive teams with aligned incentives, and short delivery cycles[2].

Not every priority comes from a growth strategy. Some come from outside. The amendment to the Polish act on the national cybersecurity system (the KSC Act), which implements the NIS2 directive, came into force on 3 April 2026. According to the schedule, entities covered by the act were to submit applications for entry in the register by 3 October 2026. For entities meeting the criteria when the amendment entered into force, the deadline for implementing the obligations specified in Article 33 is 3 April 2027. The penalties listed in Article 35 of the amendment may first be imposed two years after it entered into force[14][15]. The act increases the liability of management. As of 7 October 2026, the first of these deadlines, 3 October 2026, has already passed.

In the method presented here, this fits naturally: a legal obligation enters the shared resource plan, with its deadline and scope as constraints. The board then has to decide how to meet it and in what order relative to other initiatives. Not every company is covered by the act, so the first step is to check whether it applies to a given organisation.

The standards provide language and structure, but it is the board that must say which goals matter most and who is accountable for them. You can start with a single sheet of paper with three goals for this year.

1. Gartner, "2025 CIO and Technology Executive Survey", press release of 22 October 2024: Gartner Survey Reveals That Only 48% of Digital Initiatives Meet or Exceed Their Business Outcome Targets.
2. McKinsey & Company (in cooperation with the BT Centre for Major Programme Management, University of Oxford), 2012: Delivering large-scale IT projects on time, on budget, and on value.
3. PMI, Pulse of the Profession 2016, as discussed in: PMI research demonstrates the value of strategic alignment for projects (secondary source).
4. ISACA, COBIT.
5. COBIT Goals Cascade: How to Translate Enterprise Priorities into Governance Objectives, CIO Index (secondary study; description of the goals cascade).
6. ISO, ISO/IEC 38500:2024 (3rd edition, February 2024; it replaced the withdrawn 2015 edition).
7. ISO/IEC JTC 1/SC 40, White paper on the differences between ISO/IEC 38500:2015 and 2024.
8. ITIL 4 Guiding Principles, Clearbridge (secondary study; original: AXELOS/PeopleCert).
9. The Open Group, TOGAF Standard.
10. ISO, ISO/IEC 27001.
11. PARP, The condition of the SME sector in Poland – the latest PARP report (Kondycja sektora MŚP w Polsce – najnowszy raport PARP) (data for 2024; report published in 2026).
12. Eurostat, Cloud computing – statistics on the use by enterprises (2025 data).
13. Eurostat, Use of artificial intelligence in enterprises (2025 data, read December 2025).
14. ITwiz, The amendment to the KSC Act takes effect (Nowelizacja ustawy o KSC zaczyna obowiązywać).
15. Amending Act to the KSC Act, Journal of Laws 2026, item 252 (Articles 33 and 35), text.